SSO = single sign on. It means that you for instance sign on within the portal once, and are authenticated against any other app that you can reach from this portal... like a forum... or whatever.
There's different possible approaches how to pass this information. For instance using cookies, or using the mechanisms available by application servers like tomcat ...
It was pretty much the same for the 2.x versions I guess. In upcoming version 3 I assume there will be SSO available again. Not sure if the interfaces will be the very same. But it should be fairly easy to have the SSO mechanism work in about any of the jforum versions if you have one ready [originally posted on jforum.net by Sid]
sso.redirect will be used when authenticate user () method returns a null value .. when this happens jforum checks for sso.redirect in the systemglobals.properties file and redirects it to the URL given there.
Correct me if I am wrong .. or right for that matter
The SSO mechanism always checks if the user already exists within the db. If the user doesnt exist, it will automatically create a user with the default permission set (registered I think) and save it with default email and password attribute....
But it may be that I got it wrong myself ;)
What I did was to check if the user was created, and if it was his first login ever, I'd redirect the user to the edit-profile page, where he could add his very own email address. There i also did hide the password fields... as the password is irrelevant anyways for jforum when using sso (you can only access it with an external access mechanism, so you already are authenticated).
But: If you pass along the email address / password via cookie / url, you can also easily get the UserDAO within the SSO class, and create the user manually at this point. This also gives you opportunity to set this user to different group(s):-) [originally posted on jforum.net by Sid]